Regulation of Investigatory Powers (Acquisition and Disclosure of Communications Data: Code of Practice) Order 2015

Lord Rosser Excerpts

Monday 23rd March 2015 Lords Chamber

[Lord Rosser (Lab)]

My Lords, I, too, thank the Minister for his high-speed explanation of the purposes of these two orders which relate to emergency legislation enacted last year—namely, the Data Retention and Investigatory Powers Act, which goes under the happy name of DRIPA, which sought to retain existing data retention powers called into question, as the Minister has said, as a result of a European Court of Justice ruling. The subsequent regulations to the 2014 Act added a requirement for a code of practice on data retention to the existing requirement for a code on acquisition. Both codes are intended to set out how the legislation is to be implemented in practice. The two orders we are discussing bring the two codes into effect.

The two codes of practice before us set out the processes and safeguards governing the retention and acquisition of communications data which, as we know, can be a key factor in combating crime and terrorism and protecting children by law enforcement and intelligence agencies and other relevant public authorities, since communications data can show who was communicating, when, from where and with whom.

Both codes have been the subject of public consultation. As has already been said, the Government received some 300 submissions from organisations and individuals. When the issue of where those 300 submissions could be found was raised during the debate on these orders in the other place last week, the Minister in the Commons said he would write to my colleague, Diana Johnson MP, on this point. By the end of last week no written communication had apparently been received indicating where the responses could be seen. Perhaps the Minister could ensure that that information is provided.

The Regulation of Investigatory Powers (Acquisition and Disclosure of Communications Data: Code of Practice) Order 2015 before us enhances the operational independence of the authorising officer from the specific investigation for which communications data are required. It includes new enhanced protections for those who may have professional duties of confidentiality or privilege, particularly journalists. It reflects additional requirements on local authorities to request communications data through a magistrate, improves the record-keeping requirements for public authorities and aligns the code with best practice in regard to international co-operation and emergency calls.

The Retention of Communications Data (Code of Practice) Order 2015 deals with the new retention code implementing the requirements in the Data Retention and Investigatory Powers Act and the subsequent data retention regulations. The new retention code covers: the issue, review, variation and revocation of data retention notices; the communications service providers’ ability to recover their costs; data security; oversight by the Information Commissioner; and safeguards on the disclosure and use of retained data by communications service providers. It also outlines the scope and definitions of relevant communications data, including data that may be retained in the light of provisions in the Counter-Terrorism and Security Act 2015.

However, the 2014 emergency Act and these two codes of practice do not complete the legislative process. The Government have stated that one of the most important safeguards in the acquisition code covers access to journalistic material. The Interception of Communications Commissioner recently made recommendations following his own inquiry into police acquisition of journalists’ communications data. The acquisition code provides that an application seeking the communications data of a journalist in order to determine sources will be decided by a judge through the terms of a production order under the Police and Criminal Evidence Act 1984.

However, this is only a stop-gap measure—the Government’s words—since it is the intention of the Home Office to put this change in primary legislation in the next Parliament. The Independent Reviewer of Terrorism Legislation is currently examining the operation of the Regulation of Investigatory Powers Act 2000 and his report, which is expected to be completed before May, in a few weeks’ time, may well lead to changes in legislation. The Data Retention and Investigatory Powers Act 2014 itself has an end date of 31 December 2016, so will presumably require further consideration by Parliament.

It is all a very fragmented process of emergency legislation, of stop-gap measures, of imminent further reviews by the counterterrorism reviewer, of further primary legislation already flagged up for the next Parliament and of legislation passed only last year coming to an end in 21 months’ time. The process that has been and is being pursued for dealing with these very important issues does not exactly give the impression—whatever the reality may be—of a carefully planned, thought-through approach to what are very significant matters. Could the Minister say when it is expected that the codes of conduct we are discussing today will need to be updated and reissued in the light of the pending developments I have just mentioned?

Paragraphs 2.21 to 2.23 of the code of practice for the retention order refer to internet-based communications. Paragraph 2.21 states:

“Internet email under DRIPA is considered to be any text, voice, sound or image message sent over a public electronic communications network which can be stored in the network or in the recipient’s terminal equipment until it is collected by the recipient and includes messages sent using a short message service”.

Does that definition include social media or simply refer to internet-based email providers such as Hotmail and Gmail? Does the code of practice include messages sent on social media platforms such as Facebook? If it does, there does not appear to be a section in the guidance devoted to social media. If social media are covered, does a message extend to tagging another person? Specifically, if a person is tagged in a Facebook or Instagram post, does that count as a message for the purposes of this code? What about a person included in a tweet—does that count, as far as the code is concerned? In a situation where there is no user-generated content but there is an interaction, such as liking a post on Facebook, loving a photo on Instagram or favouriting a tweet, would these come within the code of practice?

Paragraph 2.23 says:

“An internet communications service under DRIPA as amended by the CTSA is a communications service which takes place on the internet and can include internet telephony, internet email and instant messaging services”.

The Minister in the Commons hardly clarified the position when he said in the debate on 16 March:

“The code provides that the Home Office may give further guidance to those implementing the requirements”.

He then went on to enlighten us with the statement:

“In other words, there can be further drill-down to give further specificity”.—[Official Report, Commons, 16/3/15; col. 559.]

No doubt, hopefully without too much further drilling down, the Minister will be able to assist in clarifying and placing on the record—which is quite important—how the code, including paragraphs 2.21 and 2.23 to which I have referred, should be interpreted in regard to the points and questions I have raised in respect of social media. That clarification is important and necessary.

The code of practice appears to give the Secretary of State considerable discretion over the review of retention notices, and indicates that factors leading to a review could include significant technological change. How will the dialogue with communications service providers operate and how will it ensure that the Secretary of State will be aware of major technological changes? The Minister in the Commons simply made the somewhat unhelpful and bland statement:

“The Home Office works closely with providers to ensure that it is aware of future technological changes that may lead to a review of a data retention notice”.—[Official Report, Commons, 16/3/15; col. 559.]

I do not really think that is an answer to the question that I have just asked—and was indeed asked in the Commons.

Can the Minister say why no impact assessment has been prepared in relation to the orders we are discussing? As far as I can see, these codes of practice cover the process for decisions regarding the level and extent of compensation payments provided to communications service providers and thus could have financial implications, as well as the potential to affect compliance requirements on businesses. In that regard, can the Minister say what is the total spend on compensation agreed with the communications service providers in each of the past five years?

I hope that the Minister will be able to respond—either now or subsequently—to the queries that I and the noble Baroness, Lady Hamwee, have raised on certain aspects of these two orders, which we do actually support, despite the comments I have made.

--- Later in debate ---

[Lord Bates]

It is an excellent question, but I covered that in my pacy opening remarks because I was conscious that an important Statement was due to follow.

The noble Lord, Lord Rosser, asked whether paragraph 2.21 covers social media. As Minister James Brokenshire said at the Report stage of the then Counter-Terrorism and Security Bill:

“A communication can include any message sent over the internet. The legislation relates not to the retention of what the message contained, but purely to the fact that a message was sent”.—[Official Report, Commons, 6/1/15; col. 236.]

RIPA makes that clear and extends the machine-to-machine communications examples, such as the ones that were given.

[Lord Rosser]

In the light of what the Minister has said, does that mean that it does cover social media or it does not?

[Lord Bates]

To the extent that social media are messages communicated machine to machine, it does. As to whether the specific examples that the noble Lord, Lord Rosser, talked about, such as tagging on a Facebook page or a tweet, I am going to have to get some further clarification on that and will write to him. But certainly messaging over those platforms would of course be covered.